Privacy Policy

How we collect, use, and protect your personal information.

Last updated: 10 April 2026

MketX (Private) Limited ("MketX", "we", "us", or "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our website, mobile applications, and services (the "Platform").

This policy is designed to comply with the Zimbabwe Data Protection Act, 2021 (Act No. 5 of 2021) and applicable regulations issued by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

1. Information We Collect

1.1 Personal Information

When you create an account or use the Platform, we may collect:

  • Full name
  • Email address
  • Phone number
  • Physical delivery address(es)
  • Profile photograph (optional)
  • Date of birth (for age verification where required)

1.2 Location Data

With your consent, we collect precise location data from your device to:

  • Show nearby restaurants and their estimated delivery times
  • Calculate accurate delivery fees based on distance
  • Enable real-time order tracking
  • Optimise driver routing and delivery assignments

You can disable location services in your device settings, but this may limit certain functionality of the Platform.

1.3 Payment Information

When you make a payment, our third-party payment processors collect:

  • EcoCash mobile number (for EcoCash payments)
  • Card number, expiry date, and CVV (for card payments)
  • Billing address

MketX does not store full payment card details. All payment data is processed and stored by our PCI-DSS compliant payment processors.

1.4 Device and Technical Information

We automatically collect:

  • Device type, model, and operating system
  • Unique device identifiers
  • IP address
  • Browser type and version
  • App version
  • Language and timezone settings
  • Push notification tokens (if notifications are enabled)

1.5 Usage Data

We collect data about how you interact with the Platform, including:

  • Pages and screens viewed
  • Features used and actions taken
  • Search queries
  • Order history
  • Session duration and frequency of use

2. How We Use Your Information

We use your personal data for the following purposes, each with a lawful basis under the Data Protection Act:

  • Service delivery -- to process orders, manage deliveries, and provide customer support (contractual necessity)
  • Account management -- to create and manage your account, verify your identity, and communicate account-related information (contractual necessity)
  • Payment processing -- to process and reconcile payments and issue refunds (contractual necessity)
  • Platform improvement -- to analyse usage patterns, fix bugs, and develop new features (legitimate interest)
  • Safety and security -- to detect and prevent fraud, unauthorised access, and abuse (legitimate interest and legal obligation)
  • Marketing -- to send promotional offers, recommendations, and updates about MketX (consent, which you may withdraw at any time)
  • Legal compliance -- to comply with applicable laws, regulations, and legal processes (legal obligation)

3. Data Sharing

We share your personal data only when necessary and with appropriate safeguards:

3.1 Merchants

When you place an order, we share your name, delivery address, and order details with the relevant Merchant so they can prepare your food. Merchants do not receive your payment card information.

3.2 Drivers

We share your name, delivery address, and phone number with the assigned Driver so they can complete the delivery. Drivers can only access this information for the duration of the active delivery.

3.3 Payment Processors

We share payment-related information with our payment processors (e.g., Paynow, Stripe) to process transactions. These processors are PCI-DSS compliant and process data under their own privacy policies.

3.4 Service Providers

We may share data with trusted third-party service providers who assist us with hosting, analytics, email delivery, customer support, and other operational functions. These providers are contractually obligated to protect your data and may only use it as directed by MketX.

3.5 Legal Authorities

We may disclose personal data when required by law, regulation, legal process, or enforceable governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of MketX, our users, or the public.

4. Data Security

We implement industry-standard security measures to protect your personal data:

  • Encryption -- all data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256
  • Access controls -- access to personal data is restricted to authorised personnel on a need-to-know basis, with role-based access controls
  • Authentication -- we support two-factor authentication for user accounts and require it for all administrative access
  • Monitoring -- we monitor our systems for security threats and maintain audit logs of data access
  • Incident response -- we have a documented incident response plan. In the event of a data breach, we will notify affected individuals and POTRAZ within 72 hours as required by the Data Protection Act

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

  • Active accounts -- data is retained for the lifetime of your account
  • Closed accounts -- core account data is retained for 2 years after account closure for dispute resolution and legal compliance
  • Transaction records -- retained for 7 years as required by Zimbabwe tax regulations
  • Support tickets -- retained for 3 years after resolution
  • Marketing preferences -- retained until you withdraw consent

After the retention period, data is securely deleted or anonymised.

6. Your Rights

Under the Zimbabwe Data Protection Act, 2021, you have the following rights regarding your personal data:

  • Right of access -- you may request a copy of the personal data we hold about you
  • Right to correction -- you may request that we correct inaccurate or incomplete personal data
  • Right to deletion -- you may request that we delete your personal data, subject to legal retention requirements
  • Right to restrict processing -- you may request that we limit how we use your data in certain circumstances
  • Right to object -- you may object to the processing of your data for direct marketing purposes
  • Right to data portability -- you may request your data in a structured, commonly used, machine-readable format
  • Right to withdraw consent -- where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

7. Cookies and Tracking

7.1 Cookies

Our website uses cookies and similar technologies to:

  • Essential cookies -- required for the Platform to function (e.g., session management, CSRF protection)
  • Functional cookies -- remember your preferences and settings
  • Analytics cookies -- help us understand how the Platform is used so we can improve it

7.2 Analytics

We use PostHog for product analytics to understand how users interact with the Platform. PostHog collects anonymous usage data including page views, feature usage, and session information. This data helps us improve the Platform experience. You can opt out of analytics tracking in your account settings.

8. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete such data promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

9. International Data Transfers

Your data is primarily stored and processed in Zimbabwe. In some cases, data may be transferred to and processed in other countries where our service providers operate (e.g., cloud hosting infrastructure). When data is transferred internationally, we ensure adequate safeguards are in place as required by the Data Protection Act, including:

  • Contractual clauses requiring the recipient to provide equivalent data protection
  • Verification that the receiving country has adequate data protection laws
  • Your explicit consent where required

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

  • We will update the "Last updated" date at the top of this page
  • We will notify you via email or an in-app notification
  • We will provide at least 14 days' notice before material changes take effect

Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

11. Contact Us

MketX is currently in its startup phase and has not yet appointed a dedicated Data Protection Officer (DPO). Under the Zimbabwe Data Protection Act, 2021, a DPO is required within 90 days of commencing data processing operations at scale. As we are in the pre-launch stage collecting only basic contact information (email addresses for our waitlist and business registration interest), we will appoint a DPO before our full platform launch.

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us directly:

12. Regulatory Compliance

MketX is committed to compliance with the Zimbabwe Data Protection Act, 2021 (Act No. 5 of 2021). We intend to register with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as a data controller as required by the Act.

If you are unsatisfied with our response to a data protection concern, you have the right to lodge a complaint with POTRAZ:

  • Website: www.potraz.gov.zw
  • Address: POTRAZ, Corner Samora Machel Avenue / Hampton Road, Harare, Zimbabwe